Unescaped user input in output (XSS)
Why it matters
Printing raw input lets an attacker inject scripts that run in your visitors' browsers, stealing sessions or changing what they see. Escaping turns special characters into harmless text.
echo 'Hello ' . $_GET['name'];echo 'Hello ' . htmlspecialchars($_GET['name'] ?? '', ENT_QUOTES, 'UTF-8');How to fix
Wrap output in htmlspecialchars($value, ENT_QUOTES, 'UTF-8').
Scan my code
Scan my code β
Paste a file and PHP Safe points to every line that matches this rule.